Edit the layout of the widgets.

You can toggle and resize widgets according to your needs. Select the number of Columns to use for the layout. Use Undo and Redo as you make your changes to the layout. Click Save to save the changes, or Reset to reset to the defaults.

Export the incident analysis as HTML or PDF.

In the Export Incident pane, you can review a preview of the export. You can toggle to Include Events and set the Maximum Rows for tables in the export in this pane as well.

Enrich an indicator within the incident. For more information, see Indicator enrichment.

Select a playbook to execute.

In the Select Playbook to Run pane, you can select a playbook from the table view and click Run. If there are configurable parameters for the playbook, you will be asked to configure them in the Manually Run Playbook dialog.

Run a report against the affected endpoint.

In the Run Report pane, select the Endpoint, Report, and Time Period.

Only reports with Auto Cache and Extended Log Filtering enabled can be run from an incident. For more information, see Reports Settings tab.

To attach the report to the incident, see Adding reports to an incident.

Quarantine the affected endpoint.

In the Quarantine Endpoint dialog, select the Endpoint and the Connector.

General information about the incident.

You can review and modify the following information:

• Incident Number: The unique incident ID. This is displayed, but cannot be modified.

• Incident Name: The name of the incident.

• Incident Date/Time: The date and time that the incident was created. This is displayed, but cannot be modified.

• Incident Update Date/Time: The date and time that the incident was last updated. This is displayed, but cannot be modified.

• Incident Category: The incident category, including Unauthorized Access, Denial of Service (DoS), Malicious Code, Improper Usage, Scans/Probes/Attempted Access, and Uncategorized.

• MITRE Tech ID: The techniques associated with the incident. These can be added via the dropdown list, which organizes the techniques by domain and tactic.

• Severity: The severity of the incident, including High, Medium, and Low.

• Status: The current status of the incident, including New, Analysis, Response, Closed: Remediated, and Closed: False Positive.

• Affected Endpoint: The endpoint associated with this incident. This is displayed, but cannot be modified.

• Description: A description of the incident provided by the administrator.

• Assigned To: A dropdown menu of administrators to which the incident can be assigned.

After making modifications, click Update to save your changes.

Displays comments made by administrators for this incident with a timestamp. The most recent comments appear at the top of the list.

Enter a comment and click POST to create a new comment.

Existing comments can be edited and deleted by administrators.

Displays affected asset(s) in a table view. Includes the endpoint, user, IP address, and MAC address of the asset.

Click a user in the User column to display endpoint information in a separate dialog.

The timeline of the events raised for the incident.

Scroll using your mouse wheel to change the displayed time frame. Mouse over the event to display a tooltip of its details.

Displays the events that have been raised for this incident in a table view. You can use the search bar to search for events; toggle Match Case and Use Regular Expression using the icons in the search bar.

You can perform the following actions after selecting an event:

• View Logs: Open the View Logs pane, display the related logs for the event in a table view.

• Search in Log View: Open Log View filtered by the event in a new tab.

• Delete: Delete the event.

Displays the history of changes made to an incident, including the user who made the change and information about the type of change that was made.

Click Expand All to see additional details.

The history of executed playbooks related to the incident.

Click Execute Playbook to run a playbook configured with the On_Demand trigger. See Automation.

Displays indicators attached to an incident from FortiGuard, FortiMail, or event handlers.

Hover your mouse over an indicator to view detailed information from FortiGuard or click Details under Results to view information from FortiMail including sender reputation and email statistics.

Indicator information can be attached to incidents using the FortiGuard and FortiMail connector in playbooks, or when an incident is created from an event that includes indicators identified in the event handler.

Attach and manage reports related to this incident. The reports are displayed in a table view, listing the report name, format, time range, and devices.

See Adding reports to an incident.

Displays endpoint processes associated with this incident including the process ID, process path, and network connection.

Select a time period to view by choosing a snapshot from the snapshot dropdown.

Processes can be displayed in a table format or as raw data.

Displays endpoint software associated with this incident including the software, installation path, and installation time.

Select a time period to view by choosing a snapshot from the snapshot dropdown.

Software can be displayed in a table format or as raw data.